Abstract: Dynamic attribute-based edge-deployed security in an industrial automation environment is described. A policy engine receives a command executable relevant to operational technology of an industrial automation environment via an access account. The policy engine classifies the command as approved or denied based on identifying a security policy based on the access account and operational technology, determining a set of parameter values based on the security policy, determining an intent of the command based on the set of parameter values, and classifying the command by evaluating the intent against the security policy. In response to command approval, the policy engine identifies a first communication channel coupling the operational technology and a policy enforcement point, connects a second communication channel coupling the policy enforcement point and the policy engine, and transmits the command and an indication of the first channel to the policy enforcement point via the second channel.

Abstract: Dynamic attribute-based edge-deployed security in an industrial automation environment is described. A policy engine receives a command executable relevant to operational technology of an industrial automation environment via an access account. The policy engine classifies the command as approved or denied based on identifying a security policy based on the access account and operational technology, determining a set of parameter values based on the security policy, determining an intent of the command based on the set of parameter values, and classifying the command by evaluating the intent against the security policy. In response to command approval, the policy engine identifies a first communication channel coupling the operational technology and a policy enforcement point, connects a second communication channel coupling the policy enforcement point and the policy engine, and transmits the command and an indication of the first channel to the policy enforcement point via the second channel.